147 matches found
CVE-2022-26488
In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker to add user-writable directories to the system search path. To exploit, an administrator must have installed Python for all users and enabl...
GHSA-8WRG-M8VM-5FVJ Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server
Impact Authentication Bypass by Primary Weakness CWE-305 Commit: https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1 ALL Users is impacted. Patches Yes, PLEASE UPGRADE TO v1.3.21-beta.d0ffc0a6...
Authentication Bypass by Primary Weakness in github.com/kongchuanhujiao/server
Impact Authentication Bypass by Primary Weakness CWE-305 Commit: https://github.com/kongchuanhujiao/server/commit/9a125624f219e496bdf4b07b404816d5a309bdc1 ALL Users is impacted. Patches Yes, PLEASE UPGRADE TO v1.3.21-beta.d0ffc0a6...
wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users
A flaw was found in Wildfly. An incorrect JBOSSLOCALUSER challenge location when using the elytron configuration may lead to JBOSSLOCALUSER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability...
wildfly: incorrect JBOSS_LOCAL_USER challenge location may lead to giving access to all the local users
A flaw was found in Wildfly. An incorrect JBOSSLOCALUSER challenge location when using the elytron configuration may lead to JBOSSLOCALUSER access to all users on the machine. The highest threat from this vulnerability is to confidentiality, integrity, and availability...
CVE-2021-37136
The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data which affects the allocation size used during decompression. All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack...
CVE-2020-20514
A Cross-Site Request Forgery CSRF in Maccms v10 via admin.php/admin/admin/del/ids/.html allows authenticated attackers to delete all users...
Maccms 跨站请求伪造漏洞
Maccms is a PHP-based film and television content management system CMS. Maccms version 10 has a security vulnerability that can be exploited by an authenticated attacker to delete all users via "admin.php/admin/admin/del/ids/＜id＞.html"...
CVE-2021-40352
OpenEMR 6.0.0 has a pnotesprint.php?noteid= Insecure Direct Object Reference vulnerability via which an attacker can read the messages of all users...
CVE-2021-31901
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...
CVE-2021-31901
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...
Design/Logic Flaw
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...
CVE-2021-31901
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...
CVE-2021-31901
In JetBrains Hub before 2021.1.13079, two-factor authentication wasn't enabled properly for the All Users group...
CVE-2021-22682
Cscape All versions prior to 9.90 SP4 is configured by default to be installed for all users, which allows full permissions, including read/write access. This may allow unprivileged users to modify the binaries and configuration files and lead to local privilege escalation...
PT-2021-2779 · Cscape · Cscape
Name of the Vulnerable Software and Affected Versions: Cscape versions prior to 9.90 SP4 Description: The issue is related to inadequate access control in the Cscape software. Exploitation of this issue may allow an attacker to elevate their privileges. The software is configured by default to be...
Directus Information Disclosure Vulnerability
Directus is a real-time Api and application dashboard. It is used to manage Sql database content. An information disclosure vulnerability exists in Directus version 8.x prior to version 8.8.1, which can be exploited by an attacker to view all users in the CMS using API user id...
CVE-2020-8920
An information leak vulnerability exists in Gerrit versions prior to 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, 3.2.5 where an overoptimization with the FilteredRepository wrapper skips the verification of access on All-Users repositories, allowing an attacker to get read access to all users'...
CVE-2020-8920
CVE-2020-8920 describes an information-leak in Gerrit where an over-optimization in the FilteredRepository wrapper bypasses access checks on All-Users repositories, allowing read access to users’ personal information. Affected versions are Gerrit before 2.14.22, 2.15.21, 2.16.25, 3.0.15, 3.1.10, ...
sudo: Privilege escalation via 'Runas' specification with 'ALL' keyword
A flaw was found in the way sudo implemented running commands with arbitrary user ID. If a sudoers entry is written to allow the attacker to run a command as any user except root, this flaw can be used by the attacker to bypass that restriction...